crowdsecurity/crowdsec · error

server_key is required

Error message

server_key is required

What it means

A tls block was provided in the http source config, but server_key is empty. Validate() requires both server_cert and server_key whenever TLS is configured, since the HTTPS server needs the private key matching its certificate. This fires immediately after the server_cert check passes.

Source

Thrown at pkg/acquisition/modules/http/config.go:135

	case "headers":
		if c.Headers == nil {
			return errors.New("headers is selected, but headers is not provided")
		}
	case "mtls":
		if c.TLS == nil || c.TLS.CaCert == "" {
			return errors.New("mtls is selected, but ca_cert is not provided")
		}
	default:
		return errors.New("invalid auth_type: must be one of basic_auth, headers, mtls")
	}

	if c.TLS != nil {
		if c.TLS.ServerCert == "" {
			return errors.New("server_cert is required")
		}

		if c.TLS.ServerKey == "" {
			return errors.New("server_key is required")
		}
	}

	if c.MaxBodySize != nil && *c.MaxBodySize <= 0 {
		return errors.New("max_body_size must be positive")
	}

	/*
		if hc.ChunkSize != nil && *hc.ChunkSize <= 0 {
			return errors.New("chunk_size must be positive")
		}
	*/

	if c.CustomStatusCode != nil {
		statusText := http.StatusText(*c.CustomStatusCode)
		if statusText == "" {
			return errors.New("invalid HTTP status code")
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Add server_key under the tls block pointing to the PEM private key file matching server_cert
2. Ensure the private key was actually deployed to the host and the path is correct (next failure would be a load error in NewTLSConfig)
3. Fix indentation/typo if the key exists in the YAML but isn't being parsed into the struct
4. If TLS is not intended, remove the whole tls block instead of leaving a partial one

Example fix

# before
tls:
  server_cert: /etc/ssl/server.crt
# after
tls:
  server_cert: /etc/ssl/server.crt
  server_key: /etc/ssl/server.key

if cfg.TLS != nil && cfg.TLS.ServerKey == "" {
    return errors.New("tls block present but server_key is missing")
}

func hasServerKeyPair(c *httpacquisition.TLSConfig) bool {
    return c != nil && c.ServerCert != "" && c.ServerKey != ""
}

if err := src.Configure(ctx, yamlCfg, logger, metricsLevel); err != nil {
    if strings.Contains(err.Error(), "server_key is required") {
        logger.Error("http source: tls configured without server_key")
    }
    return err
}

When it happens

Trigger: YAML sets tls: with server_cert but omits server_key, or server_key is empty due to a misspelled key name or wrong indentation. Raised by Configuration.Validate() (config.go:133-136).

Common situations: Users set both cert and key to the same file and then remove the key entry; split cert/key files where only the cert was copied into the config; templating systems that render the server_key field empty when a secret is missing.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• server_cert is required
• mtls is selected, but ca_cert is not provided
• invalid auth_type: must be one of basic_auth, headers, mtls
• max_body_size must be positive
• invalid threshold: must be > 0 and <= 1

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/c0abaf3436808323. Report an issue: GitHub.